From aef83ee958a480755447de93e2d6498c464e56e8 Mon Sep 17 00:00:00 2001 From: Hongbo Wu Date: Fri, 23 Sep 2022 16:33:57 +0800 Subject: [PATCH] Escape HTML entities in Twitter title and description --- packages/content-fetch/twitter-handler.js | 6 ++++-- packages/content-fetch/youtube-handler.js | 1 + 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/packages/content-fetch/twitter-handler.js b/packages/content-fetch/twitter-handler.js index 99bab6661..7ae93072c 100644 --- a/packages/content-fetch/twitter-handler.js +++ b/packages/content-fetch/twitter-handler.js @@ -6,6 +6,7 @@ require('dotenv').config(); const axios = require('axios'); const { DateTime } = require('luxon'); +const _ = require('underscore'); const TWITTER_BEARER_TOKEN = process.env.TWITTER_BEARER_TOKEN; const TWITTER_URL_MATCH = /twitter\.com\/(?:#!\/)?(\w+)\/status(?:es)?\/(\d+)(?:\/.*)?/ @@ -116,7 +117,8 @@ exports.twitterHandler = { const tweetData = (await getTweetById(tweetId)).data; const authorId = tweetData.data.author_id; const author = tweetData.includes.users.filter(u => u.id = authorId)[0]; - const title = titleForAuthor(author) + // escape html entities in title + const title = _.escape(titleForAuthor(author)) const authorImage = author.profile_image_url.replace('_normal', '_400x400') let text = tweetData.data.text; @@ -157,7 +159,7 @@ exports.twitterHandler = { - + ${front} diff --git a/packages/content-fetch/youtube-handler.js b/packages/content-fetch/youtube-handler.js index cdf9bee32..e1866428a 100644 --- a/packages/content-fetch/youtube-handler.js +++ b/packages/content-fetch/youtube-handler.js @@ -37,6 +37,7 @@ exports.youtubeHandler = { const oembedUrl = `https://www.youtube.com/oembed?format=json&url=` + encodeURIComponent(`https://www.youtube.com/watch?v=${videoId}`) const oembed = (await axios.get(oembedUrl.toString())).data; + // escape html entities in title const title = _.escape(oembed.title); const ratio = oembed.width / oembed.height; const thumbnail = oembed.thumbnail_url;